We deliver the register of information package you need to file.

• The completed register

  Every reporting template populated, in the structure your authority reads, ready to file under your own name.

• The classification record

  Every function identifier, service type and criticality call, with its reasoning and the contract clause it came from. This is what you show a supervisor who asks why.

• The chase list

  The vendor-dependent gaps, named: which provider, which field, and a draft request. Yours to send; prepared on best efforts.

• The board memo

  What was decided, what was assumed, and what is still open — written for the people who carry the responsibility for filing.

Registers are submitted to your national competent authority — in Luxembourg the CSSF, and elsewhere the ACPR in France, the Central Bank of Ireland, BaFin in Germany, the FSMA in Belgium. Each runs its own submission channel and its own timetable. We prepare the package to the published format and hand it to you to file.

1. 1

   Day 1

   The contract audit

   • Under NDA, we work from the contracts, order forms and amendments you already hold. Nothing is asked of a vendor at this stage.
   • Each arrangement is read for what the register needs from it: the parties, the dates, the notice periods, the governing law, and where the service is actually provided.
2. 2

   Day 2

   Classification

   • The function identifier and the type of ICT services in RT.02.02RT.02.02RT.02.02Contractual arrangements – specific informationB_02.0218 fieldsThis template provides details in relation to each contractual arrangement listed in template B_02.01 with regard to: (a) the ICT services included in the scope of the contractual arrangement; (b) the functions of the financial entities supported by those ICT services; (c) other important information in relation to the specific ICT services provided (e.g. notice period, law governing the arrangement, etc.).For one cloud contract, this is the long form: which entity uses it, which provider supplies it, the type of service, start and end dates, notice periods on both sides, governing law, where the data sits at rest, and how sensitive it is.It carries more fields than any other template, so it is where most of the filling-in time goes.Full entry → are decided arrangement by arrangement, and written down with the reasoning attached.
   • Provider identity in RT.05.01RT.05.01RT.05.01ICT third-party service providersB_05.019 fieldsThis template lists and provides general information to identify: (a) the direct ICT third-party service providers; (b) the ICT intra-group service providers; (c) all subcontractors included in template B_05.02 on ICT service supply chain; (d) the ultimate parent undertaking of the ICT third-party service providers listed in points (a), (b) and (c).The vendor list. For each provider: its identification code and what kind of code that is, its name, the country of its headquarters, the total annual cost, and its ultimate parent undertaking.Every identification code here is read against the type of code it declares itself to be.Full entry → is resolved from public sources wherever it can be: identification code and type, country of headquarters, ultimate parent.
3. 3

   Day 3

   The judgements only you can make

   • RT.07.01RT.07.01RT.07.01Assessments of the ICT servicesB_07.0112 fieldsThis template captures information in relation to the risk assessment of the ICT services (e.g. substitutability, date of last audit, etc.) when those ICT services are supporting a critical or important function or material part thereof.For each service supporting a critical or important function: could this provider be replaced, when was it last audited, is there an exit plan, could the service be brought back in house, and has an alternative provider been identified.These are the judgements no vendor can make on your behalf.Full entry → needs a view on substitutability, on reintegration, and on whether an alternative provider exists. We bring the evidence and the options; your risk function decides.
   • One 45-minute session with compliance and risk closes the open questions, rather than sending them back and forth by email.
4. 4

   Day 4

   What has to come from outside

   • Sub-contracting in RT.05.02RT.05.02RT.05.02ICT service supply chainB_05.027 fieldsThis template identifies and links the ICT third-party service providers that are part of the same ICT service supply chain.A bank’s payroll provider stores its data with a cloud host, which uses a third firm for backups. RT.05.02 records that chain rank by rank — the part of the register most firms cannot answer from their own contracts, because the answer sits with the vendor.Sub-contracting is where a dependency nobody contracted for turns up.Full entry → is the one part of the register your own documents often cannot answer. We produce a chase list: which vendor, which missing field, and a draft request ready to send.
   • That list is yours. We prepare it on best efforts and hand it over as your action. We do not pursue vendors on your behalf, and we do not carry the risk of their silence.
5. 5

   Day 5

   The filing package and the memo

   • The register is assembled into the reporting package your authority expects, and put through our own validation before it reaches you.^[2]
   • A memo for your management body: what was decided, on what basis, and what remains open. Priced as accountability, not as file conversion.

1. [1]The ESA reporting template carries 14 reporting templates, RT.01.01 to RT.07.01, plus RT.99.01, which is an options legend rather than a reportable template. spec/RegisterInformation.xlsx — Counted from the ESA reporting template held in /spec/. A public URL for that workbook is pending owner confirmation (spec/SOURCES.md). ↩
2. [2]A submission is an xBRL-CSV reporting package following Report Package 1.0, containing META-INF/reportPackage.json and a reports folder. Source (opens in a new tab) ↩